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TITLE 

METHOD OF NETWORK ADDRESS PORT TRANSLATION AND 
GATEWAY USING THE SAME 

BACKGROUND OF THE INVENTION 

5 Field of the Invention 

The present invention relates to a gateway, and 
in particular to a network address port translation 
(NAPT) gateway providing fast look-up and translation 
of network addresses and ports in virtual servers. 

10 Description of the Related Art 

Fig. 1 is a schematic diagram of a NAPT gateway. 
Fig. 2 is a schematic diagram of a method for 
translation in a conventional NAPT gateway, in which a 
virtual internal network contains servers 12 0 and 122 

15 of which private (virtual) internet protocol (IP) 
addresses are SI and S2 respectively. The external 
network comprises hosts 100, 102, and 104, public IP 
addresses of which are CI, C2 and C3 respectively. 
The hosts 100, 102, and 104 set up a connection to the 

20 NAPT gateway 110 device using ports CP1, CP2 , and CP3 . 
The public IP address of the NAPT gateway 110 is 
address G. The NAPT gateway 110 has a virtual server 
mapping table 112 recording GP1, SP1 corresponding to 
GP1, GP2 , and SP2 corresponding to GP2 . 

25 When external host 100, 102, or 104 transports 

data packets to ports GP1 or GP2 of NAPT gateway 110, 
the NAPT gateway 110 performs NAPT, transports the 
data packets to port SP1 of the internal server 120 or 
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port SP2 of the internal server 122, and records the 
translation data in NAPT table 114 for translation of 
returned outgoing data packets of the same connection 
from the internal servers. 
5 The translation data recording port CP1 of host 

100, port GP1 of NAPT gateway 110, and port SP1 of 
internal server 12 0 are recorded in the NAPT 
translation table 114, as shown in Fig. 2. The host 
100 transports a data packet 13 0 to the NAPT gateway 

10 110, which contains source IP address, source port, 
destination IP address and destination port. The 
source IP address and the source port are IP address 
CI and port CP1 of the host 100. The destination IP 
address and port are IP address G and port GP1 of NAPT 

15 gateway 110, wherein the port GP1 corresponds to port 
SP1 of the server 12 0. When receiving data packet 
130, the NAPT gateway 110 searches the translation 
data in the NAPT translation table 114 by hashing or 
linear searching. When the translation data is 

20 located, the data packet 130 is translated into data 
packet 132 destination IP address and port of which 
are IP address SI and port SP1 of server 120. 

In reverse direction, server 120 transports a 
data packet 134 to the external host 100. The data 

25 packet 134 contains source IP address SI, source port 
SP1, destination IP address CI and destination port 
CP1 . When receiving data packet 134, the NAPT gateway 
110 also searches the translation data in the NAPT 
translation table 114 by hashing or linear searching. 

3 0 When the translation data is located, the data packet 
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134 is translated into data packet 136 source ' IP 
address and port of which are public IP address G and 
port GP1 of the NAPT gateway 110. 

Linear search of the translation data in the NAPT 
5 translation table 114 is extremely time-consuming, and 
hashing can cause collision, in the event of which, 
rehashing or linear searching can solve the collision. 
Even so, if a hash function is not chosen properly, 
time spent on hashing will be as much as that spent on 
10 linear searching. 

SUMMARY OF THE INVENTION 

Accordingly, an object of the invention is to 
provide a method of fast look-up and translation of 
network addresses and ports in a NAPT gateway. When a 

15 data packet is transported from an internal server to 
an external host through the NAPT gateway, the 
destination address or port information therein can be 
directly mapped to translation data corresponding to 
the data packet in the NAPT translation table without 

20 hashing or linear searching. 

To achieve the foregoing object, the invention 
provides a method of fast look-up and translation of 
network address and port, performed in a gateway 
connecting a virtual internal network and an external 
25 network. The virtual internal network comprises at 
least a server, and the external network includes at 
least a host. First, a translation table is created, 
comprising a plurality of translation data entries 
each of which is provided with an index and comprises 
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host address and port information, server address and 
port information, and gateway address and port 
information. The server address and port information 
further comprises internet protocol (IP) address 
5 information and port information. Next, a first data 
packet containing first source address and port 
information and first destination address and port 
information from the external host is received by the 
gateway. The first source address and port 

10 information comprises IP address information and port 
information. Corresponding translation data of the 
first data packet in the translation table is 
searched. The first source IP address or port 

information is translated into a factor related to the 

15 index of the translation data and the first 
destination address and port information are 
translated into the server IP address and port 
information of the corresponding translation data when 
the corresponding translation data of the first data 

20 packet is located. The first data packet is 

transported to a corresponding internal server 
according to the server IP address information 
therein. 

In addition, a second data packet comprising 
25 second source address and port information and second 
destination address and port information from the 
internal server is received by the gateway. The 
second destination address and port information 
comprises second destination IP address and port 
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information, one of which acts as a second factor 
related to a second index according to the system 
design. The related second index is acquired according 
to the second factor and corresponding translation 
data of the second data packet is got from the 
translation table according to the second index 
directly. Next, the second source address and port 
information are translated into gateway address and 
port information of the translation data, and the 
second destination IP address or port information are 
translated into host IP address or port information of 
the translation data. The second data packet is 
transported to a corresponding external host according 
to the IP address thereof. 

15 In addition, the invention provides a network 

address port translation (NAPT) and fast look-up 
gateway connecting a virtual network and an external 
network, comprising a translation table, a receiving 
unit, a processing unit and a transporting unit. The 

20 translation table comprises a plurality of translation 
data entries each provided with an index and 
comprising host address and port information, server 
address and port information, and gateway address and 
port information. The server address and port 

25 information comprises internet protocol (IP) address 
and port information. The receiving unit receives, 
from the external host, a first data packet comprising 
first source address and port information and first 
destination address and port information. The first 
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source address and port information comprises first IP 
address and port information. The processing unit 
searches corresponding translation data of the first 
data packet in the translation table and translates 
5 the first source IP address or port information into a 
factor related to the index of the translation data 
and the first destination address and port information 
into the internal server address and port information 
of the corresponding translation data when the 

10 corresponding translation data of the first data 
packet is located. The transporting unit is coupled 
with the processing unit and transports the first data 
packet to a corresponding server according to the 
server IP address therein. 

15 In addition, the receiving unit receives, from 

the internal server, a second data packet containing 
second source address and port information and second 
destination address and port information. The second 
destination address and port information contains 

20 second IP address and port information, one of which 
acts as a second factor related to a second index 
according to the system design. The processing unit 
acquires the related second index according to the 
second factor, retrieves corresponding translation 

25 data of the second data packet from the translation 
table according to the second index directly and 
translates the second source address and port 
information into gateway address and port information 
of the translation data and the second destination IP 

30 address or port information into host IP address or 
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port information of the translation data according to 
the system design. Finally, the transporting unit 
transports the second data packet to a corresponding 
external host according to the IP address of the 
5 corresponding host . 

BRIEF DESCRIPTION OF THE DRAWINGS 

The present invention can be more fully 
understood by reading the subsequent detailed 
description and examples with references made to the 
10 accompanying drawings, wherein: 

Fig. 1 is a schematic diagram of a conventional 
NAPT gateway. 

Fig. 2 is a schematic diagram of the NAPT method 
for a conventional NAPT gateway. 
15 Fig. 3 is a structural diagram of the NAPT 

gateway according to the first embodiment of the 
present invention . 

Fig. 4 is a schematic diagram of the method of 
network address port translation and fast look-up in 
20 the first embodiment of the invention. 

Fig. 5 is the structural diagram of the NAPT 
gateway of the second embodiment of the invention. 

Fig. 6 is a schematic diagram of the method of 
network address port translation and fast look-up in 
25 the second embodiment of the invention. 

DETAILED DESCRIPTION OF THE INVENTION 

As summarized above, the present invention 
provides a method of fast look-up and translation of 
network address and port performed in a NAPT gateway. 
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Fig. 3 is a structural diagram of the NAPT gateway 
according to the first embodiment of the present 
invention. 

The NAPT gateway 310 connects a virtual internal 
5 network and an external network. In this embodiment, 
the virtual internal network containing server 32 0 and 
322 private IP addresses of which are SI and S2 and 
providing service on port SP1 and SP2 respectively. 
As well, the external network contains hosts 300, 302, 

10 and 304 legal public IP addresses of which are CI, C2 
and C3 and connecting to a NAPT gateway 310 device 
using port CP1, CP2 , and CP3 respectively. The NAPT 
gateway 310 is provided with a legal public address G, 
and comprises a virtual server mapping table 312. The 

15 virtual server mapping table 312 stores a plurality of 
mapping data entries each comprising server address 
and port information containing a private IP address 
and port information of a server and corresponding 
gateway address and port information containing a 

2 0 gateway IP address and gateway port information, 
wherein gateway IP address is a public IP address of 
the gateway 310, and gateway port information is a 
corresponding port of the port of the server where 
service is provided. In this embodiment, two sets of 

2 5 mapping data are stored in virtual server mapping 
table 312: [G, GP1, SI, SP1] and [G, GP2 , S2, SP2] , 
representing that port GP1 and GP2 of NAPT gateway 310 
mapped to port SP1 of server 32 0 and port SP2 of 
server 322 . 
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As well, a NAPT translation table 314 is 
maintained in NAPT gateway 310. NAPT gateway 310 
provides each set of translation data with an index. 
Each set of translation data comprises host address 
5 and port information, server address and port 
information, and gateway address and port information, 
wherein host address and port information comprises a 
host IP address and host port information, server 
address and port information comprises private server 

10 IP address and port information, and gateway address 
and port information comprises gateway IP address and 
gateway port information. The gateway IP address 
comprises the legal public address of the NAPT 
gateway, and the gateway port information comprises a 

15 port number of the NAPT gateway corresponding to the 
port of a server where service is provided. The NAPT 
gateway 310 further comprises a processing unit 316 
controlling network address look up and translation. 

Fig. 4 shows a schematic diagram of the method of 

20 fast look up and translation of network address and 
port in this embodiment of the invention. The host 
300 in the external network transports a data packet 
330 from port CP1 to port GP1 of NAPT gateway 310. 
The data packet 330 includes source IP address, source 

25 port information, destination address, and destination 
port information. The source IP address comprises the 
IP address CI of the host 300, and the source port 
information comprises the port CP1 from which the host 
300 connects to the NAPT gateway 310. The destination 

30 IP address comprises the public IP address G of NAPT 



9 



Client's ref. : STLC-01-K9206 
File : 0213 -10410-usf/ Joseph/Kevin 

gateway 310, and the destination port is the port GP1 
of NAPT gateway 310 corresponding to port SP1 of 
server 320. 

Normally, after receiving data packet 33 0 using 
5 transport-and-receiving unit 317, the NAPT gateway 310 
searches NAPT translation table 314. If the 

corresponding translation data is not located in the 
NAPT translation table, the NAPT gateway 310 searches 
the virtual server mapping table 312. In this 

10 embodiment, data packet 330 is the first packet 
transported to port GP1 of NAPT gateway 310 by host 
300, so virtual server mapping table 312 is searched 
for the related mapping data of the data packet 330. 
After searching and determining that the data packet 

15 330 is to be transported to the port SP1 of the 
internal server the address of which is SI, the 
processing unit 316 acquires an unused entry of NAPT 
translation table 314 the index of which is II to 
store NAPT translation data. The NAPT translation 

2 0 data comprises private server IP address SI and 
private server port information SP1, gateway IP 
address G and gateway port information GP1, host IP 
address CI and host port information CP1 . 

Next, the processing unit 316 translates the 

25 destination IP address and port information into 
private IP address SI and port SP1 of server 32 0 and 
source port into a factor Jl related to the index II 
corresponding to the entry recording the translation 
data. Thus, the data packet 330 is translated into 

30 data packet 332. The factor Jl may be the index II or 
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produced by adding index II to a constant, where the 
maximum value of the factor Jl is 2 16 -1. Finally, the 
transport-and-receiving unit 318 of the NAPT gateway 
310 transports the data packet 332 to the real 
5 destination, i.e. server 320, according to the 
destination IP address. 

In addition, the server 320 can return data 
packet 334 from port SP1 through NAPT gateway 310 to 
the host 300. The data packet 334 comprises source IP 

10 address, source port information, destination IP 
address, and destination port information. The source 
IP address and source port comprise IP address SI and 
port SP1 of server 320, and the destination IP address 
and the destination port comprise IP address CI of the 

15 host 300 and the factor Jl related to the index. 

When NAPT gateway 310 receives the returned data 
packet 334 the factor Jl of which equals the index II, 
the factor Jl is directly mapped to the translation 
data the index of which comprises II to perform NAPT. 

2 0 If factor Jl is produced by adding index II with a 
constant, when the index II is acquired by a simple 
operation, the index II is directly mapped to a 
translation data the index of which is II in the NAPT 
translation table 314 to perform NAPT. The 

25 translation data is acquired without hashing or linear 
searching, so time is saved, and the processing speed 
of the packet is enhanced. After acquiring the 
translation data, the NAPT gateway 310 performs a 
comparison to ensure that the acquired translation 

30 data is correct. 
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Next, the processing unit 316 replaces the source 
IP address and source port of data packet 334 
respectively with G and GP1 7 comprising the public IP 
address of the NAPT gateway 310 and the port of the 
5 NAPT gateway 310 corresponding to the port SP1 of 
server 320 and the destination port with port CP1 of 
the host 3 00 recorded in the translation data. Thus, 
the data packet 334 is translated into data packet 
336. Finally, the transport -and- receiving unit 317 of 
10 the NAPT gateway 310 transports the data packet 336 to 
host 300 according to the destination IP address 
therein. 

Referring to Fig. 3, the host 3 02 in the external 
network can also transport a first data packet of a 

15 data stream from the port CP2 to the port GP2 of NAPT 
gateway 310. The first data packet comprises source 
IP address, source port information, destination IP 
address, and destination port information. After 
receiving the data packet, the NAPT gateway 310 

2 0 searches the virtual server mapping table 312 
according to the data packet, determining that the 
data packet is to be transferred to port SP2 of the 
server IP address of which is S2 . Because the data 
packet is the first packet of the data stream, an 

25 unused entry with index 12 of NAPT translation table 
314 is located and used to record the translation data 
comprising private IP address S2 and port information 
SP2 of the server 322, IP address G and port 
information GP2 of the gateway 310, and IP address C2 

30 and port information CP2 of the host 302. In 
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addition, host 3 04 in the external network can also 
transport a first data packet of a data stream from 
the port CP3 to the port GP1 of NAPT gateway 310. The 
first data packet includes source IP address, source 
5 port information, destination IP address, and 
destination port information. After receiving the 
data packet, the NAPT gateway 310 searches the virtual 
server mapping table 312 according to the data packet, 
determining that the data packet is to be transferred 

10 to port SP1 of the server the IP address of which is 
SI. Because the data packet is the first packet of 
the data stream, an unused entry with index 13 of NAPT 
translation table 314 is located and used to record 
the translation data including private IP address SI 

15 and port information SP1 of the server 32 0, IP address 
G and port information GP1 of the gateway 310, and the 
IP address C3 and port information CP3 of the host 
304. Next, the translation of the data packet, 
similar to that mentioned above, includes not only 

20 translating the destination IP address and destination 
port but also translating source port into a factor 
related to an index. Thus, when receiving the 

outgoing data packet from the internal (virtual) 
network, the NAPT gateway 310 of the invention can 

25 acquire the translation data by direct mapping and 
transport the outgoing data packet to external hosts 
302 or 304 . 

In addition, when subsequent data packets of the 
same data flow are transported from the external 
3 0 network to the internal network, due to the 



13 



Client's ref. : STLC- 01 -K9206 
File : 0213-10410-usf /Joseph/Kevin 

translation data being recorded in the NAPT 
translation table 314, the NAPT gateway 310 of the 
invention searches the corresponding index using 
hashing, as with a general NAPT gateway. Next, the 
5 translation of the data packet, similar to the first 
data packet, comprises not only translating the 
destination IP address and destination port but also 
translating a source port into a factor related to an 
index. Thus, when receiving the returned packets from 

10 internal network to external network, the NAPT gateway 
310 of the invention acquires the corresponding 
translation data of the returned data packets by 
direct mapping, translating and transporting the 
returned data packets. 

15 Fig. 5 is a structural diagram of the network 

address port translation (NAPT) gateway of the second 
embodiment of the invention. Fig. 5 is similar to 
Fig. 3 and is further characterized by the processing 
unit 516 which controls the network address and port 

20 look-up and translation using a different method. It 
should be noted that the elements in Fig. 3 and Fig. 5 
performing the same functions are labeled with the 
same number. 

Fig. 6 shows a schematic diagram of the method of 
25 fast look up and translation of network address and 
port in the second embodiment of the invention. The 
host 3 00 in the external network transports a data 
packet 33 0 from port CP1 to port GP1 of NAPT gateway 
510. The data packet 330 comprises source IP address, 
30 source port information, destination address, and 
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destination port information. The source IP address 
comprises IP address CI of the host 300, and the 
source port information comprises port CP1 from which 
the host 300 connects to the NAPT gateway 510. The 
5 destination IP address is public IP address G of NAPT 
gateway 510, and the destination port is port GP1 of 
NAPT gateway 510 corresponding to port SP1 of server 
320 . 

Normally, after receiving data packet 33 0 using 

10 transport -and-receiving unit 317, the NAPT gateway 510 
searches NAPT translation table 314. If the 

corresponding translation data is not located in the 
NAPT translation table, the NAPT gateway 510 searches 
the virtual server mapping table 312. In this 

15 embodiment, data packet 330 is the first packet 
transported to port GP1 of NAPT gateway 510 by host 
3 00, so virtual server mapping table 312 is searched 
for the related mapping data of the data packet 330. 
After searching and determining that the data packet 

20 330 is to be transferred to the port SP1 of the 
internal server the address of which is SI, the 
processing unit 516 acquires an unused entry of NAPT 
translation table 314 the index of which is II to 
store NAPT translation data. The NAPT translation 

25 data include private server IP address SI and private 
server port information SP1, gateway IP address G and 
gateway port information GP1, host IP address CI and 
host port information CP1 . 

Next, the processing unit 516 translates the 

30 destination IP address and port information into 
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private IP address SI and port SP1 of server 32 0 and 
source IP address into a factor Jl related to the 
index II corresponding to the entry recording the 
translation data. Thus, the data packet 330 is 
5 translated into data packet 532. The factor Jl may be 
produced from index II logically operated with 
[10.0.0.0], wherein maximum value of the factor Jl is 
2 24 -l. The factor Jl may be produced from index II 
logically operated with [172.16.0.0], wherein maximum 

10 value of the factor Jl is 2 20 -l. The factor Jl may be 
produced from index II logically operated with 
[192.168.0.0], wherein maximum value of the factor Jl 
is 2 16 -1. Finally, the transport -and-receiving unit 
318 of the NAPT gateway 510 transports the data packet 

15 532 to the real destination, i.e. server 320, 
according to destination IP address. 

In addition, the server 32 0 can return data 
packet 53 4 from port SP1 through NAPT gateway 510 to 
the host 300. Because direct mapping in the method of 

2 0 the second embodiment depends on IP address, the 
method works even if the data packet 534 is IP 
fragmented. The data packet 534 comprising source IP 
address, source port information, destination IP 
address, and destination port information. The source 

25 IP address and source port comprise IP address SI and 
port SP1 of server 320, and the destination IP address 
and the destination port comprise factor Jl related to 
the index and the port CP1 of the host 300. 

When the index II is acquired from the factor Jl 

30 by a simple operation, the index II is directly mapped 
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to a translation data the index of which is II in the 
NAPT translation table 314 to perform NAPT 
translation. The translation data is acquired without 
hashing or linear searching, so time is saved, and 
5 packet processing speed is enhanced. After acquiring 
the translation data, the NAPT gateway 510 performs 
comparison to ensure that the acquired translation 
data is correct. 

Next, the processing unit 516 replaces the source 

10 IP address and source port of data packet 534 
respectively with G and GP.l , comprising the public IP 
address of the NAPT gateway 510 and the port of the 
NAPT gateway 510 corresponding to the port SP1 of 
server 320 and the destination IP address with the IP 

15 address CI of the host 300 recorded in the translation 
data. Thus, the data packet 534 is translated into 
data packet 336. Finally, the transport-and-receiving 
unit 317 of the NAPT gateway 510 transports the data 
packet 336 to host 300 according to the destination IP 

2 0 address. 

Referring to Fig. 5, the host 302 in the external 
network can also transport a first data packet of a 
data stream from the port CP2 to the port GP2 of NAPT 
gateway 510. The first data packet includes source IP 

25 address, source port information, destination IP 
address, and destination port information also. After 
receiving the data packet, the NAPT gateway 510 
searches the virtual server mapping table 312 
according to the data packet, determining that the 

30 data packet is to be transferred to port SP2 of the 
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server the IP address of which is S2 . Because the 
data packet is the first packet of the data stream, an 
unused entry with index 12 of NAPT translation table 
314 is located and used to record the translation data 
5 including private IP address S2 and port information 
SP2 of the server 322, IP address G and port 
information GP2 of the gateway 510, and IP address C2 
and port information CP2 of the host 302. In 
addition, host 304 in the external network can also 

10 transport a first data packet of a data stream from 
the port CP3 to the port GP1 of NAPT gateway 510. The 
first data packet comprises source IP address, source 
port information, destination IP address, and 
destination port information also. After receiving 

15 the data packet, the NAPT gateway 510 searches the 
virtual server mapping table 312 according to the data 
packet, determining that the data packet is to be 
transferred to port SP1 of the server the IP address 
of which is SI. Because the data packet is the first 

2 0 packet of the data stream, an unused entry with index 

13 of NAPT translation table 314 is located and used 
to record the translation data including private IP 
address SI and port information SP1 of the server 320, 
IP address G and port information GP1 of the gateway 
25 510, and IP address C3 and port information CP3 of the 
host 304. Next, the translation of the data packet, 
similar to . that mentioned above, not only translates 
the destination IP address and destination port but 
also source address into a factor related to an index. 

3 0 Thus, when receiving the outgoing data packet from the 
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internal (virtual) network, the NAPT gateway 510 of 
the invention acquires the translation data by direct 
mapping and transports the outgoing data packet to 
external hosts 302 or 304. 
5 In addition, when subsequent data packets of the 

same data stream are transported from the external 
network to the internal network, due to the 
translation data being recorded in the NAPT 
translation table 314, the NAPT gateway 510 of the 

10 invention searches the corresponding index using 
hashing, as with general NAPT gateways. Next, the 
translation of the data packet, similar to the first 
data packet, includes not only translating the 
destination IP address and destination port but also 

15 translating source address into a factor related to an 
index. Thus, when receiving the returned packets, by 
IP fragmented or not, from internal network to 
external network, the NAPT gateway 510 of the 
invention can acquire the corresponding translation 

2 0 data of the returned data packets by direct mapping, 

then translates and transports the returned data 
packets . 

It should be noted that, in this embodiment, the 
NAPT gateways without load balance function are used 
25 as examples, although the method of network address 
fast look-up and translation of network address and 
port of the invention can also be implemented in a 
load balancing NAPT gateway. 

To sum up, the method of network address port 

3 0 translation and fast look-up of the invention can be 
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performed in a NAPT gateway. When the data packets 
are transported from an internal server to a NAPT 
gateway, the indices drawn from destination IP 
addresses or destination ports can be directly mapped 
5 to the translation data in the NAPT translation table 
without hashing or linear searching. Thus, the method 
of network address port translation and fast look-up 
of the invention enhances packet processing speed. 

While the invention has been described by way of 

10 example and in terms of the preferred embodiments, it 
is to be understood that the invention is not limited 
to the disclosed embodiments. To the contrary, it is 
intended to cover various modifications and similar 
arrangements (as would be apparent to those skilled in 

15 the art) . Therefore, the scope of the appended claims 
should be accorded the broadest interpretation so as 
to encompass all such modifications and similar 
arrangements. 
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